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(57)Abstract: 

PROBLEM TO BE SOLVED: To provide a VPN communication method for a 
security gateway device that brings a PC accessed externally via a WAN 
into a communication enabled state as a virtual terminal under a LAN. 
SOLUTION: This invention provides a VPN communication method for the 
security gateway device 103 that interconnects the WAN consisting of 
public channels or the like and the LAN 104 through a concentration 
conversion processing. In the case of realizing a VPN 108 for an external 
PC 101 connected to the WAN by dialup connection with an IPsec protocol, 
a DHCP communication option is integrated with IKE data at an IKE 
communication before the IPsec communication so as to realize designation 
of a sender IP address C that is IPsec-processed in a tunneled IP packet. 
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(54) B8f»0>*#] WaU^ •y-h9x*r8«fc*tt*VPNam#tt 



(57) [KM] 

[HUH] WAN^ir^br^t^tSPCS: 

an l o 4 irora^r*ij9 ■ XHU&miz£ * 
^yr^f «y-h?x^ 10 3 tc*5tf 5VP Nil fa 
*jfc-ofcor, /^t;i/7 ^^^r-WANtc^u/c 

^SflGDPC 10 1 (c^j-LT I P s e c h ^/McJ; t? 
V P N 1 0 8 SBR, I P s e c iiffic $fciro I 

KEiSffP*^, DHCPlflt^v'ay^IKEf-^ 
h>* y >-^$iX)t I P'<tr y Hc*5tf£ I 

p s e c&mztiz&mTt I P7 F^c^m 



IF7 KU*:B 
103^ 



B 



106~ 



IP7hVX:C 



IP7hVX:A 



108 



/ /lOl 



104 



109 

/ 



101 PC 

103 t*aUr-f^-Wx-f»a 

104 LAN 

106 *5-f7>MMee>5f7>hPO 

108 VPN 

109 IPytjryh 



f» 1 



(2) 

1 

[»»!*# *>ibb] 

[1**9(1] ^*EI*|lftifd»b*a*ixSWANfcLA 

■ y- h x >f KliC^lt 6 V P N»j|*Sr*c t , 
^ W 5»^*«WANt««lft»«(OPCI:» ' 
LTIPsec^Ph 3;l/(^J; 9 V P N 5 BR. 

I P s e c 51 fS {C5feil0 I KEaift^ptC, D HC PiifS 
t^>a >£r I KEf-^Ct^ U h is* V >?£tx 

ft I P^y y M:^|j5 I P s e c«L3l§n5^fS7C I 

<< mm: i^(^vp n mm 

[1**112] IKEiifgP#{C, -ir^r^y^^ • y— h !> 
^-f^SIfiTOL AN £P Cir y^ > b<D I P7FI/^ 

LANC7 ***i-S1ffl|B**B<0PCfc:*J0 MaT, ffilS 
^«5(7> P C SrfKigjftM L ANiSTCI^fcVP Nil ft 

*ie«i-5»*«iKiE«<ai?*^ y^ • y- h 

[1***1 3] NATa**jB**fo1i:TlWlB^«OPC 

*!6*tlfc L ANIS*^^*fr|E^ffl5^P cd^or ^-t 
^ ^"STffi* VPNaifS S-fer^ a. yf^f • y— h 

[«9j0i$ttfeR9j] 

[0 0 0 1 ] 

[$s^co*-#-5Sfl5#wi it^pc^i 

IfcLAN^MEi^^^WAN (Wi d e Ar e a 
Network) 3r^feS! ■ ^^M3l£:fT 

^saifc^sopc^wAN^^ir-fe^ayr-f • 

y— h ^x-fgt^VPN (Virtual Priv 
ate Network, {R3»*fflJH) ilff 5 

^t^ayf^f ■ h fraL^SSflUdlfcttS VPNilft 

[0 0 0 2 ] 

r-t^ 0 »6opccifiits*iSLANt>r^^ ^ 

^ HC^j^-TSii^ LANtWAN^Kt^y — h 
?>3i-<KS^i^5f(C^So LAN^$(OPC^ 
b L ANETO«*|C 7 ^ t ^ 1 5 left, ^f^Lt 
l^yn/^^^W^iil, WANgit' 
LANETtf>«** (WttfPC) Ic7^-t^f5-^ic 

[0 0 0 3] WAN«rStn5/^y MiS*« 
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2 

te, wANirLANiSiRts-fe^ayf ^ • y— h £ 

£ftTfct^£^tf Jfel^ 0 -t IT, ^|5*>b7 ^ir^-T^ 
PC (^(7)PC) ^-t^rzL y x^f • y- h >>^Y^S 
oP^T-v P NiifSSrtT 5 r WANK«/£l 
ffli^^Hit^S, VPNiifS607t>i>(7>fta 

w*afS^o b^i/ut img^nti/^^ii i p s e 

c (Security Architecture f 
or the Internet Protocol) 

[0 0 0 4 ] J^T{-, I P s e c Srfljffl LfcVPNiiff 

[ooos] 04i^v^r, i o ii^7 p p/uyicy^ 

t^7^7 p ^tfc^gOPC, 10 2I3WAN, 10 
3I2WAN 10 2 ^il(7)LAN 10 4 £rge^LT3l^ 
■ aE**k3 «TfT 5t^ra y 7^ - y— h !>x-f, 104 
i31?3f a. !)7>f ■ y— h £ai-f 1 0 31BTCOL AN, 1 
0 5ttLAN10 4i©t-/<«*, 1 0 6, 1 0 7li 
L AN 1 0 4 ±cO^ 7-f7>FPC, 108liPC10 

ut^^yf-f • y— h[)x^fio3 iror^r* i p s 

[0 0 0 6 ] ^t;U7s/^«aLtPCl 0 1#LA 
N 1 0 4_h^^^(CT^ir^-f^^^, t^rxyr^ - 
y~ h[)x>f 103 ^ItVPN 1 0 8£rtf|£:L, w 
AN 1 0 2 ±T«^/£ffflif^^IIf5 0 :5i 
TWAN 10 2 ±^aiftrt«*rffilK ■ &g[T-# J; 5 

ia, l an i o 4&T<oi&Mtmm&ft5o 
[0 0 0 7 ] I P s e cmm&ffitzMz&mte 
aftrtS^StaHcoi^THSSr.fflo^rWR-rs. B5» 

wANia ssa^twANSSit^Se 

[0 0 0 8 ] 15 (C^^t, P C 1 0 1 , WAN 1 0 

2, tdrayr^ ■ y— h[)x>{103{il4 £H3^CD 

[0009] PClOUir^r^yf^ • y — h & ^ J 
10 3 ^2^f I P s e cilff £rtT?l§£\ 7^—^ 

A, ^17;u^yXA(^^5tiff ^ri^f^I P s e 

i&r*e^-f £ *35fe £ * IKE (internetKey 
Exchange) n;u^f ^Tll^fS 

*rfe<7>2ii t>3*&6o mw^^ST-^s I 

So 

[0010] #cic, g 6 SrJB^T I P s e c iifa Coi^ 



Tlfc^-rSo B6I4 I P s e c&{§fflib<Dltlto<D-Z*r~ 
!lf^ • ¥ — h^x-f 10 3^iM / 7t7n-f^r- 

[0011] iPseca»«:fT5fc^:ii, 2^H^ 

>S A (Secur i ty 
Association) Ufctffttfft * 

t\ *Ofcai>fc: I KESft«t2o*>:7ac — 

(7) I KE- S A&SI&LJ; 5 £ L (Sll, S12) , 



(3) &ffl 2001-160828 

**ltCjft3bLfc 7*— X2l;i*5^X\ IPsecii 

(S 1 3) o 7x-X2t I P s e c — S A 5 
^ fc3&«T*ntt (S 1 4) IKEiifiSrJ&TU IPs 

e caflr**Mtt-r& (s i s) . ^f^^sn^iK 

E (7x-X2) ilff l-Ss^T I P s e ciifSSrtT 5fc 
^^2jSIBI^*#4x-6«a* (*1) 
[0012] 
[^1] 



3i a 




-fe^aUr'f • stated 


ESP/AH | 


IPsecxS^-t — H 





























[0013] LBbfE^E— K ( I P s e c 51{f ^ — K) 

l»t^/^^r-, ::r-it i p s e c (nmr^e 
- KB h K^jr««t5. 
[0014] H 7 B: h I P s e c iiff <F> 

wtm*7F-tmm®x*&>z> 0 30 

[0015] 07 IC&^T , PC101, t^a!J7-f 
•y-h^x'f 103, LAN104, ^7^7^ hP 

C106, VPN1 0 8fii4<l:^fOt>C0T^5o 1 

0 OB I P'<try hT^So 

[0016] B 7 ICfcS^T, PC101, t^rayf-f 
• y — h!>x^l03, ^7>f7yhPC106OIP 

laotpci o i ictt-^nfc iptki/^i. la 

N104J:(7)^7^7yhPCl 0 6 5&^VPN108 
^lt3^^^3 vco^bixytPC 1 0 1 l: I Pa**" 40 
S> + ^f^7^f7yhPC106(^ 

V N "C , i^fs7C I P7K^C, ?55fc I P7 F'^^A 

oip/^^hio o^ms^n. iSfssns. 
yf^f ■ h^x^io 3^c<7)^^s/ hio o^rS 
fib, vpNios^^^nfcPcioijgr^/^j/ 

■B$Rfcs-H>r i p ^hioo £#7^ y >y-r 

5 0 I P7 Kl^aftlHK:. i^ftjc I P7K^ 

B, ?TQ$fe I P7 K^AO I P^y<?&ttM£tlZ>o Z 



N 1 0 8 ^r^Lt^yt ]) V^SiX*:'*^* h^Sfll 
fcPCloitt, ^Lfcltffllcg^^T^i? y >y 
£ixfz7z<D I P^>rs> h 1 0 UJL. M3®*r6 0 

[0017] 

m^rmxit, wani 0 2±xw7 f — 

* ^S»$n5fc«>, LAN104KT^^7-f7yr 
P C 1 0 6 OMlC7^ t^fSfc^lC, LAN104 

KT<7)^7^7yhPcio6(c^ (r^-i?;**^/ 
^FM^Sr^-r-fc*:* y 7^ . #y Wttttt 
*TT5 I P7 Ku^^^fp-q^^^^n h=r/u • tr 

HHj6*££5*5rffitta**>!K LAN104^7^- 
h I P 7 K ^*T»«j*£;h,*:*s/ h 7 — *rtf> 

[0018] ^ <d± ^-xi/f^ • h * ^ ^®{C^o 

5VPNiifE£i£T-B, WAN£fr\^Xftm>j)*hT ? 

5 p c4r(K3BWt-L ANier©i*i \^xmm^ 

[0 0 19] -(D^^Zmt^-ttzfr, WAN 

4^tr^«d^7^-t^tS P C«:{E2B«(::l A NIB 



*• t 



(4) 
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[0 0 2 0 ] 

(:«P|ot^ra 'Jr^f • y— h »x^fgfm5V 

LAN^(7)n^«« • sE**aa«cj: t> d 
T\ f-i-TfrT ^gltwAN{;8ittW?)PC 

I P s e cSff KSfcSCO I KEilffP#{C, DHCP 
iiff^J-^a I KEr-^C^l, h^U^y /<? 

ztitz. i p/^j/ h«c^oit s i p s e c^mztizmm 

7C I PT Kl/^^^It5iS^fit^$ 0 
[ 0 0 2 1 ] Z.tllZ.X*), WAN^LT^a^b7^ 
fS P C L ANET<?)«*i: LTilff "sj 

[0 0 2 2 ] 

«g • fttita Dttttts*^^ y • y— h £^ 

^»r*WANlC^iLt^^)PC^Lr I P s e 
c h=i;McJ: D VPN^rilt6^, iPseel 

ft tC&Sro I KEiI{a0#(C, DHCPlflt^g^ 
I KEf-^C^l, h^!) vy^tvfd I P^y > 
H^&tf 5 I P s e c #y££ix5i£{f I P T KU*<7> 

[0 0 2 3 ] C<D$|j&fCj; 19, -fc** U^-f ■ y- V $ 

s e cjiffi-£l&, fOPCWf»/£M I PTF> 

^^jSJ^IIKct, l ANffiT^«^*>R5£&*33£ 

[0 0 2 4 ] »3fc*I 2 MlEifcCOi? ^ayf^f ' y — h £ 

^>rsgeic*5(tsvPNiiff*i*tt, f»*JBi tcia*^ 

t^rx'Jf-f • y- h *:n-Yg«tC:i3tt£V PNiff* 
grlc&^T, I KE51fgP#{c, -fer^rxt. }) ?■ 4 ' V £ 

^-T $S«ET<Z>L. AN Ci?y^ VhOI P7K^ 
/^^V Y~**?T Y\s**¥<< -YfrT y7Wm.frb 

L ANtCT n^tSMOP CM*]«? , ^£|5tf>P 40 

CSMKBtolcL ANSSTt-e^fcVPNiiff^rHm-r 
-5 ^ t t l^t'i><DT~hZ> 0 

[ 0 0 2 5 ] ^coMf&^X 19 , v PN&W&Lfci^aifc) 
PC^ LANSSrtCfcSJ: 5 tc«2Btt*£*ft-£6«UH 

[0 0 2 6 ] »*3Cg3 (cfS^co-t !)f>f ■ h 0 

*>rs6«c*5ttsvpNaff*«fe«c, »*iii{cia*(o 

t^rayr-i' • y- h *:*-f £S«fci:J3tt5V PNM* 
gitCSo^T, NATgM^bft^iOPCCL 
ANBT^filt^S^?^^ hlPTK^S:! 50 



KEiiffustctt-s-u ^^Y^-h 1 P7H>^r*fi 

$tltLAN^^^WPC*^07^t^^«Ii 

[0 0 2 7 ] 9, y7^f^MP7F> 

^T-iiS^fcLANSSI:, «c£tt*r*«Lfc*** 
S<^PC^bw7^t^^l:fSi^5^ffli:tt 

So 

[0 0 2 8 ] EAT* #»!fio*ifco*«fco^-t\ 11 

[0 0 2 9 ] B3tt, 
WilcJ: £-fer*-^ yf^f • y- h ^x^gti^lj^ 
VPNM^SI^^tffl^S I KEmifr — ??* — 

[0 0 3 0 ] i3lC^tl^ I KEiifliUDP (U 
ser Datagram P r — otocol)/I 
P (Internet Protocol) &r^^ It 
fffc>*i£ 0 I KEf-^il ISAKMP (Inter 
net SecurityAssociation a 
nd Key Management Prot — oc 
o 1 ) ^s> ^^>^(- I SAKMP^Y Ki*jft«Ott 

Sl^rS^tS^ftf (-f^$/:n— <$r. Initiate 
r) £^;h,l£ttLTffi#-r£JGS## (U^tfvy, Re 
s-ponder) (aoffibn^c #3lifeff>J#1BU: 

IT^f — ^ 5/ Hcg^ELfcP C lOUMniti 
atori*5, LAN104iW«*HTW^7'{ 
7yhPC 1 0 6, 1 0 7C7^t^f6tfe^ t^f 

x y T-f • y— h^x^fio3{ci KEaMHttu 

ir a. U x -f * y — h<?x^fl03^Re s ponde 

r^iriKEi(f^ff5o (*i) \z.mfTz.m%<r>o 

m-^mtmmmn, ^mmm^^m^x i n i 

tiator^Responder (75 WCf* J lft»^S6* 
Z:tl%Xft<Dm&\*. Initiator 
Responderd* Initiator <DWi 

7<<T> Vfr^X'fi t>tlZ>» DHCP (Dyna 
mic Host Configuration Pr 
o t o c o \) PJ-iT^Vt ITOP C 1 0 1 

t^^oiSSirtr, IP7F^, Ws/^ 
I P7H>^(Df^Pl> hV^f^^^^o - 
ixb 4 o<7>'l9«S: I KEaft^*5^^TR e s p o n d e 

r t-fest^a yf>r • y— h?x^fio3 3&^a«o i 

KEf-^T-t^ay^LTWMSo fil, IP7 

Ki^^w^rs&JWffitt 1 KEifl(cj;or*i^5SA 
fcDHCPtUDPWiffl:fitt57^y y-v-a v 

[0 0 3 1 ] Hitt*«W©*16^«ttl«-*5W5 1 P 
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[0 0 3 2 ] Hi icrfc^T, PC101, ir y x^ 
•y-h^x-f 103, LAN104, ^7^7>FP 
C106, VPN 1 0 813114 tffi&Oh&X'foZo 
[0 0 3 3] Hi tc*5t^r, PC101, ir^^yr^f 
. y — h^x^l03, ^7^7yhPC106OIP 

laotPClOl \Ztf^£*ltL IP7h>^) . * 
fc, I P s e ciiff lc$fcSco I KESlfttcj; 0 , i?*^ 
yf>f • y-h[>xY 1 0 31^:, PC10 1ICI P7K 10 
U^D^MtS, LAN1 0 4 J:<7)^7^7y hPC 
l06^bVPN10 8 Sr;frLT=r^^ v'a ^O^bfr 

fc P c l o 1 1: I P y h t iS« 1 5 , Si"* 7 
>{7yhPC106(:fc^T, LAN10 4Wt^n 

^laoxpc ioi (citji9 mxhtiit I P 7 F> 

;*A&;gg&-r£C£ft< , mmyt IP7K^C % 
5fe I P7K^DOI P^**s> h 1 0 9^f^rit*4x, 

i^ft^n^o t^rayr^f • h^)x^io3^io 

/^^hl0 9^§flt, VPN108^^ilfiPC 
l 0 i*6Ttf>A**-5> ht^5: fcSrHSU-fSi:, IKE 20 
iiftU:j;S£lfeLfctt«U:£<5^T I P^-5r j; M o 9 
Sr^^-lr y v^-T£ 0 k;co i P7 K t^oJMWK, i£ff 
7t I P7 K^B, £55fc I P7 F>^A^) I P^ytffr 

ftt>tiZ Q VPN10 8^Lt^'/ir'j>^^tlfc^ 
^ h*gft U:PC l 0 l 13, S9ftUfcW*RfcX*3i^ 
T^^i? y V^^tlfeTCO IP/^jxhlO 9£&9 m 
L, I KEilfftCfc 19 h^^, 
-f >-^^T7ctc I P^ j/hi09 ^r^a^i-So 

[0 0 3 4] H 2 13 ir * a y X -f • hl)x^l03 
^PCl0il:iP7 K^D«:E*t5¥IBt/7t7 

[0 0 3 5 ] I P s e ciiff £fT?fc#>tCl3, 2/£PflT» 

^Ofc^lC I KEilff 13 2o07x-X|:^ 
ilt^T, 7 x - X 1 {^^V^TS^ft I K E IffSrff 3 
tztfy<D I KE-S A^r^fiit Let 9 i t (SI, S2) , 

^entc^^u^b. :7^—X2U::J3^t, ipseci 

(S 3) o 7x-X2t- I P7 K^DSrESU I P 
s e c - S ASrtfiirf 5 £ri*T-£ixi3 (S 4 ) IKE 
iif§£r*&T-f£ (S5) 0 ^f^XS3^IKE {7 
— X2) ig{f{C:*o^T I P s e c mia&ft 5 fr#>{C 2 

[0 0 3 6 ] &>±<n& 5\z*:mM<oJ&1&lz.£ti& % 

*?>VT y XSat'WA N 1 0 2 UcPCl 0 1IC 

^ITIPsecyn 9 VPN 1 0 8 SrHS, 

t5R, I P s e cilff lC$fcfto I KEiif§P#^, DH 
C Piiff^v'a V£ I KEf-^l:«^L, h^>y 50 
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>?£tltz I P'**ry HCSSttS I P s.e c%±m$tlZ> 
MS I P7 Fi/^OSH (T K^COjgS) 

>f 10 314, ^7^7s//i^lfcM^)PC10 1 
^ I P s e c -t<OP C<rc*lfcWfc*B5fc I P 

T Kl^^AS:*JW5Iffi^U, LAN104IST^^7^ 
T> h«8*l 0 6 ^oKSSr^Kfc-r* <o 

[0 0 3 7 ] (|U£<Dftm 2 ) #»W<DjMK<D«tt 2 (C 

J:6-ir^^y^^-y- h £:x.-Y^©lc:*otf SVPNil 
ft 2f$r£:H 1 Srfflv^TR«t6. 
[0 0 3 8] HIl (C$3 l^T , I K EiifaOR e s p o n 
d e r "CfcS-fe^-a. y X >T • h^x^l03d>bl 
n i t i a t o r TfcSP C 1 0 1 CDHC PW<B4:ffi 
ffi-TSKIK, t^rayr^f ■ h()x^i o 3IST^ 
LAN104^Ct^yhOI P7K^, 
y h-^*^ Srffi*IJ"*-S. VPN108i4S^IPse 
cii{flC*5l^T, VPN10 8i«il6/^^h^ 
13, LAN104M^b«t5PC101t>, i?3r 
ayr^y-h^x^io 3l£T^^7'f7y h«S* 
1 0 6 y V V — if* V V JiK»J*>ftv\ L/5>>1> 
-*ft«*& LTilfa£*T?o 
[0 0 3 9 ] ]^±cd j: 5 , I K 

EilfaWc, -fc*^ yr^ • h^^io 3S£T^ 
LAN104^i:t^^yhi7)I P7 KU^/t^* 
5/ V-**?T K^$:^t^7^7 P M^t 3 LANl 
0 4 C7 9 -fer^-f -5 P C 1 0 1 \ZM V ^T, *V$V><DPC 
10 1 ^MWCLAN 1 0 4f8«~n-S^fcVPNii 
ft Sr^S.-*"* «fc ?\Z.L,tiZ. t\Z.£*) ^ VPN108^5l 
&L/^S15G0P C 101^LAN10 4 ilrt{C#>6J: 
5{c{SSW«-^ft-rci ^3^t*^S^T% ^^f^^r5i«b 
fc**^9J3&*feL AN 1 0 4 rt(^^*lc7 ^-ir^-TSr 

[0 0 4 0 ] (Ht(7)»ji3) - *«n^Xtt0^tt3U 

[0 0 4 1 ] Hi (C*5V>T, t^ayf-f • h C> ^ 

-{10 3^NAT ( Net-work Addres 
s Translator) g»ff£>BH\ t^ayr^f 
- h?x-f 10 3 IBT<^> LAN 104 ^r^^-f 
h I P7 KU^^ti«Lt^fc»^, ii«l3^$W> 
bLANl 04i(73^7^7> hiffi^l 0 6CI47n 
*T?*ftlf*#, y^t^7j/X^LtPC10U-t 
a y t • h^x^l 0 3^VPN 1 o 8^5ii: 
-T-Sfc^o I KEiiffO^r-, t^ra^^f • h 
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